nightly.yml

name: nightly

# Every job's logic is `cargo run -- --ci <job>` (build/ci.rs); this file says
# where each one runs.

on:
  schedule:
    - cron: '0 3 * * *'
  workflow_dispatch:

concurrency:
  group: nightly-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  # The host cache's writer restores nothing, and `seal` is green only once
  # build/cicache.rs has sealed the tree the save stores; `stored` reads back
  # what the save stored.
  host:
    runs-on: ubuntu-24.04
    timeout-minutes: 90
    permissions:
      contents: read
      # `stored`'s read of the repository's cache list.
      actions: read
    env:
      # The driver's own target, and no step's: it says this job carries the
      # host cache (build/cicache.rs).
      CARGO_TARGET_DIR: target/ci-driver
      # The driver's and every step's: a backtrace in a log reads line tables,
      # and nothing reads the rest of the debuginfo, of which a Linux link
      # copies every dependency's into each binary.
      CARGO_PROFILE_DEV_DEBUG: line-tables-only
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          fetch-depth: 0

      - run: cargo run -- --ci seal

      # The host cache's one writer. Only main's entries are readable from
      # every branch.
      - if: github.ref == 'refs/heads/main'
        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
            ~/.cargo/registry/index
            ~/.cargo/registry/cache
            ~/.cargo/git/db
            target
          key: &entry host-sealed-${{ runner.os }}-${{ runner.arch }}-${{ github.run_id }}

      # Red where the save stored nothing: it only warns.
      - if: github.ref == 'refs/heads/main'
        env:
          ENTRY: *entry
          GH_TOKEN: ${{ github.token }}
        run: cargo run -- --ci stored

  toolchain:
    uses: ./.github/workflows/toolchain.yml

  # Skipped off main, where the driver refuses it by name.
  release:
    needs: toolchain
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

      - uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: ${{ needs.toolchain.outputs.sysroot-path }}
          key: ${{ needs.toolchain.outputs.sysroot-key }}
          fail-on-cache-miss: true

      - env:
          GH_TOKEN: ${{ github.token }}
        run: cargo run -- --ci release

  kvm:
    needs: toolchain
    if: ${{ !cancelled() }}
    # Its container's pull.
    permissions:
      contents: read
      packages: read
    uses: ./.github/workflows/guest.yml
    with:
      kvm: true
      sysroot-key: ${{ needs.toolchain.outputs.sysroot-key }}
      sysroot-path: ${{ needs.toolchain.outputs.sysroot-path }}

  tcg:
    needs: toolchain
    if: ${{ !cancelled() }}
    # Its container's pull.
    permissions:
      contents: read
      packages: read
    uses: ./.github/workflows/guest.yml
    with:
      kvm: false
      sysroot-key: ${{ needs.toolchain.outputs.sysroot-key }}
      sysroot-path: ${{ needs.toolchain.outputs.sysroot-path }}

  # `cargo run -- --build-only` from a fresh machine. `sid` as it stands,
  # image and archive both, and no cache — a fresh machine is the premise.
  portability-linux:
    runs-on: ubuntu-24.04
    timeout-minutes: 350
    container:
      image: public.ecr.aws/docker/library/debian:sid
    steps:
      - name: deps
        run: |
          for attempt in 1 2 3; do
            apt-get update -qq > /tmp/apt.log 2>&1 \
              && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq git curl ca-certificates \
                   build-essential qemu-system-x86 python3 cmake >> /tmp/apt.log 2>&1 \
              && break
            [ "$attempt" = 3 ] && { cat /tmp/apt.log; exit 1; }
            sleep 20
          done
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          curl --proto '=https' --tlsv1.2 -sSf -o "$RUNNER_TEMP/rustup-init.sh" https://sh.rustup.rs
          sh "$RUNNER_TEMP/rustup-init.sh" -y --profile minimal --default-toolchain stable
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - &checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

      - run: cargo run -- --build-only

  portability-macos:
    runs-on: macos-latest
    timeout-minutes: 350
    steps:
      - *checkout
      # Homebrew keeps one QEMU; `cargo run` notes it if it is not the declared one.
      - run: |
          brew install qemu cmake
      # 1.98.1 and not `stable`: 1.99.0 compiles a host test into an endless loop
      # here (issues/the-nightlys-macos-job-pins-rustc-1-98-1-for-a-hang-its-test-no-longer-shows.md).
      - run: |
          curl --proto '=https' --tlsv1.2 -sSf -o "$RUNNER_TEMP/rustup-init.sh" https://sh.rustup.rs
          sh "$RUNNER_TEMP/rustup-init.sh" -y --profile minimal --default-toolchain 1.98.1
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - run: cargo run -- --build-only
      # The host suite's macOS arms run here alone: `ci.yml`'s `host` is Linux.
      # The driver ends a cargo that goes silent and names it (build/ci.rs's
      # `heard`); this is for a step that hangs while it talks, and is the
      # limit `host` above runs under.
      - timeout-minutes: 90
        run: cargo run -- --ci host
      # Where macOS reports a process a signal ended with a core, every
      # thread's stack in it: what the driver's SIGQUIT leaves of a silent step.
      - if: failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: macos-crash-reports
          path: ~/Library/Logs/DiagnosticReports
          if-no-files-found: warn
          retention-days: 7